A new Linux VPS should be hardened before it hosts an application. Use the provider’s initial account only long enough to create a named administrator, install that user’s SSH public key, verify a second key-based session, then disable direct root and password logins. Add firewall rules for the actual SSH port and required services before enabling UFW, and keep a provider console or other recovery path open throughout.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The commands below use an Ubuntu Server-style image and a DigitalOcean-style provisioning flow. User groups, service names, initial usernames, SSH ports, cloud-firewall behavior and console access vary by distribution and provider, so record those details before changing anything.
As an Amazon Associate I earn from qualifying purchases.
What to record before you connect
Write down the server’s public IP address, Linux distribution and image, initial username, SSH port, provider console URL or equivalent, and whether a provider-level cloud firewall is already attached. Some images use a provider-created username rather than root; some providers require their web console for first access; and an SSH service may already be listening on a nonstandard port.
Do not assume that changing the SSH port is a security control by itself. A custom port can reduce accidental collisions with another service, but it must be documented and allowed explicitly at every firewall layer. Treat the port number as an operational detail, not a substitute for key authentication and least privilege.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prepare a recovery route
Keep the provider console credentials and an emergency recovery method documented. A second terminal connected through the original account is also part of the recovery plan. DigitalOcean’s initial setup guidance advises staying logged in as root until you have verified that the replacement account can log in and use sudo. The same principle applies when the provider calls the initial account something else: never close your working session while testing access changes.
Connect with the initial account, then create a named administrator
Connect using the provider’s documented first-login path. Replace the placeholders in the example with the actual initial username, address and port:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ssh INITIAL_USER@SERVER_IP
# If the provider uses a custom SSH port:
ssh -p SSH_PORT INITIAL_USER@SERVER_IPOn Ubuntu, create a named account with adduser and place it in the sudo group:
sudo adduser deploy
sudo usermod -aG sudo deployChoose a name that identifies a person, team or controlled automation identity. Avoid sharing one administrator login among several people; individual accounts make access removal and audit trails practical. The exact administrative group is distribution-dependent. Ubuntu commonly uses sudo; Debian, RHEL and provider-customized images may use a different group or policy. Confirm the image documentation before assuming the group name.
Check the account before leaving the first session
Confirm that the account exists and has the intended group membership:
id deploy
getent passwd deploy
groups deployDo not grant additional groups merely for convenience. Add only the administrative capability required for the work you plan to perform. Application services should normally run under separate, unprivileged service accounts rather than under this administrator.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Install an SSH public key safely
SSH key authentication uses a private key that remains on the administrator’s workstation and a matching public key stored on the VPS. Copy only the public key to the server. Never paste or upload the private key to the VPS, a ticket, a chat transcript or a shared document.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Use an existing protected key or generate an Ed25519 key
If the administrator’s workstation already has a protected OpenSSH key, use its public half. Otherwise generate an Ed25519 key locally:
ssh-keygen -t ed25519 -f ~/.ssh/vps_admin_ed25519Accept a strong passphrase when prompted. The public key is the file ending in .pub; the private key is the file without that suffix. Protect the private file with the workstation’s normal file permissions and, where practical, an agent or hardware-backed store.
Place the public key in the target account
Ubuntu’s OpenSSH documentation identifies ~/.ssh/authorized_keys as the public-key authorization location. From the initial session, create the directory with ownership and permissions that prevent other users from modifying it:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →sudo install -d -m 700 -o deploy -g deploy /home/deploy/.ssh
sudo touch /home/deploy/.ssh/authorized_keys
sudo chown deploy:deploy /home/deploy/.ssh/authorized_keys
sudo chmod 600 /home/deploy/.ssh/authorized_keysAppend the single-line contents of the administrator’s public-key file to /home/deploy/.ssh/authorized_keys. One common approach is to connect from the workstation with ssh-copy-id, using the initial account while it is still available:
ssh-copy-id -i ~/.ssh/vps_admin_ed25519.pub deploy@SERVER_IPIf the provider uses a custom port, include -p SSH_PORT. If ssh-copy-id is unavailable, use the provider console or the initial shell to append the public key manually, then recheck the ownership and mode commands above. Do not replace an existing authorized key blindly; other legitimate recovery keys may be present.
Prove key login and sudo before changing SSH policy
Open a second terminal. Keep the original session untouched and test the exact account and private key you intend to use for routine administration:
ssh -i ~/.ssh/vps_admin_ed25519 deploy@SERVER_IP
# For a custom port:
ssh -i ~/.ssh/vps_admin_ed25519 -p SSH_PORT deploy@SERVER_IPAfter login, confirm the identity and privilege transition:
Recommended Free Tools
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
whoami
id
sudo -vsudo -v refreshes or validates the sudo credential without changing system state. You can also run a harmless command such as sudo whoami; the expected result is root. If key authentication or sudo fails, fix it while the initial session remains open. Do not proceed to disable root or passwords based on an untested client command.
Common key-login failures
- Permission denied (publickey): verify that the public key is complete, on one line, in the target user’s
authorized_keys; check ownership of the home directory and.sshdirectory; and make sure the client is offering the matching private key. - The wrong account is selected: confirm the username in the SSH command. A key installed for
deploywill not authenticate as the initial provider account unless it is installed there too. - Host key or address confusion: confirm the server IP and compare the host-key warning with the provider’s console information before accepting a changed identity.
- Sudo is unavailable: inspect group membership and the image’s administrative policy. Do not grant unrestricted privileges by copying an arbitrary configuration from another distribution.
Disable direct root and password SSH access after verification
Only after the second terminal has successfully logged in with the key should you alter the SSH daemon policy. Review both the main configuration and any image-specific drop-in files:
sudo less /etc/ssh/sshd_config
sudo ls -la /etc/ssh/sshd_config.d/Drop-in files can override settings in the main file, so check the effective configuration rather than editing one file and assuming it wins. Set the supported directives so that direct root login and password authentication are disabled:
PermitRootLogin no
PasswordAuthentication noUse the provider’s documented equivalent if its image manages SSH settings another way. Public-key authentication remains available; disabling password authentication does not disable keys. If an automation account still requires a different authentication method, document that exception and scope it narrowly instead of re-enabling passwords globally.
Validate, then reload without terminating the working session
Validate the daemon configuration before asking it to reload:
sudo sshd -tA successful test normally produces no output. If it reports a line number or an unknown directive, correct the file and run the test again. On Ubuntu the service is commonly named ssh; other distributions commonly use sshd. Reload the name used by the image rather than guessing:
sudo systemctl reload sshIf the image uses the alternate service name, use sudo systemctl reload sshd. Keep both terminals open and start a fresh connection as deploy to verify that the new policy works. Do not log out of the known-good session until this test succeeds.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Configure UFW before enabling it
Ubuntu’s documentation describes ufw as the default, user-friendly firewall configuration tool. A firewall is useful only when its rules match the services the VPS actually needs. Start by inspecting available application profiles:
Free tools Windows power users keep installed
One-click scans. No signup required.
sudo ufw app listAllow the real SSH service first
If the SSH service uses the profile’s standard port, allow the profile before enabling UFW:
sudo ufw allow OpenSSHFor a custom port, allow the exact TCP port instead:
sudo ufw allow SSH_PORT/tcpSubstitute the real number, not the literal text SSH_PORT. If you use IPv6, ensure the rule and UFW’s IPv6 policy cover the address family your provider assigns. A rule that works for IPv4 does not automatically prove that IPv6 access is permitted or restricted as intended.
Add only required application ports
Before adding a rule, identify the service that will listen on it and whether it should be public. For example, a web server may need its documented HTTP or HTTPS ports, while a database usually should remain private or limited to a specific source network. Do not open broad ranges “for later”; add a narrowly scoped rule when the service is ready.
# Examples only—use ports required by your actual services:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpRules for application ports belong after the SSH rule is in place. If you are uncertain which processes are listening, inspect the server before opening access and again after deployment:
sudo ss -tulpnEnable and inspect the firewall
Once SSH and required service rules are present, enable UFW:
sudo ufw enable
sudo ufw status verboseRead the resulting default policies and every listed rule. Verify both IPv4 and IPv6 behavior where the VPS has both address families. Keep the second SSH terminal connected while enabling UFW, then make a fresh connection from the administrator’s workstation. If that new connection succeeds and only intended services are reachable, the firewall change has passed the practical test.
Cloud firewall and host UFW: choose clear ownership
Many VPS providers offer a cloud firewall in addition to the operating system firewall. The cloud layer filters traffic before it reaches the virtual machine; UFW filters traffic on the host. Running both can be effective, but unexplained duplicate rules make outages harder to diagnose. Decide which layer owns each rule and record that decision.
| Concern | Provider cloud firewall | Host UFW |
|---|---|---|
| Management location | Provider control panel or API, outside the guest OS | Commands and configuration inside the VPS |
| Recovery advantage | Can block traffic even when the guest is unhealthy; may be editable without logging in | Available for local policy and service-specific administration; requires guest access or console recovery |
| Address families | Check how the provider expresses separate IPv4 and IPv6 rules | Inspect UFW status and IPv6 policy on the host |
| Rule ownership | Useful for perimeter restrictions shared across several servers | Useful for rules tied to this machine’s installed services |
| Logging and diagnosis | Use the provider’s documented logging and audit view | Use UFW status and host logs available on the distribution |
Do not assume that allowing SSH in one layer overrides a deny in the other. Traffic must pass both policies. Conversely, opening a port in both places does not make the service safe if the application itself is misconfigured. Record the SSH port, source restrictions and intended application ports in the provider firewall and the host configuration so another administrator can reconstruct the path.
Root session, sudo user and authentication choices
| Choice | Operational benefit | Risk or cost | Recommended use |
|---|---|---|---|
| Direct root SSH | Immediate access during bootstrap or emergency recovery | Maximum blast radius and weak individual attribution; a stolen root credential grants everything | Temporary provider access only, then disable direct login |
| Named user with sudo | Individual identity, auditable elevation and smaller default blast radius | Requires correct group membership and a tested recovery path | Routine administration |
| Password SSH | Can be used from a new workstation without a key file | Exposes a reusable secret to online guessing and operational mistakes; may be disabled by provider policy | Do not retain for SSH when key access is verified |
| SSH key authentication | Private key stays with the administrator; public key can be revoked per account | Loss of the private key or passphrase can interrupt access unless another key or console route exists | Baseline for the administrator account |
Key authentication is not a reason to eliminate recovery planning. Keep a second authorized key under controlled ownership or use the provider console according to your organization’s policy. Rotate and remove keys when personnel or machines change, and do not copy one person’s private key to multiple workstations.
Final verification checklist
- Record the provider, distribution, public IP, initial username, SSH port and console route.
- Keep the initial session open and create the named administrator.
- Grant only the image’s required administrative group.
- Install the administrator’s public key in the target account’s
authorized_keyswith correct ownership and permissions. - Log in from a second terminal with the intended private key and confirm
sudo -v. - Review the main SSH configuration and drop-ins; set
PermitRootLogin noandPasswordAuthentication nowhere supported. - Run the daemon’s configuration test, reload the correct service, and make a fresh key-based connection.
- Allow the real SSH profile or custom port before enabling UFW.
- Add only ports required by deployed services, then enable UFW and inspect verbose status for IPv4 and IPv6.
- Check listening services with
ss, confirm the provider firewall’s rule ownership, and document the emergency recovery path.
Recovery and troubleshooting branches
You are locked out immediately after enabling UFW
Use the provider’s web console or recovery mode rather than repeatedly guessing from the client. Inspect UFW status, add an allow rule for the actual SSH port, and test from a separate terminal before closing the console session. If a cloud firewall is also present, check that layer for a deny or missing IPv6 rule.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallThe SSH daemon will not reload
Return to the still-open session or console and run the configuration test again. Check both /etc/ssh/sshd_config and /etc/ssh/sshd_config.d/ for conflicting directives, spelling errors or unsupported options. Correct the reported line, validate, then reload.
The new account works with a key but not with sudo
Check id deploy and the distribution’s administrative-group documentation. Group membership may require a new login session before it is recognized. If the image does not use Ubuntu’s sudo group, follow that image’s documented privilege policy while keeping the account named and individual.
SSH works over IPv4 but not IPv6
Verify that the server has an IPv6 address, that the provider cloud firewall allows the intended IPv6 source and port, and that UFW’s IPv6 policy contains the corresponding rule. Test each address family separately; a successful IPv4 connection does not validate IPv6.
A service is unreachable after the firewall change
Confirm that the process is listening on the expected interface and port with sudo ss -tulpn. Then trace the policy in order: provider cloud firewall, UFW rule, local service binding and application configuration. Remove broad temporary rules after identifying the required narrow rule.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsDigitalOcean’s production guidance, verified 1 October 2026, summarizes the target state as “SSH key authentication for a sudo non-root user, no password-based access to root, and a cloud firewall to restrict access to SSH only.” Apply that pattern deliberately to the provider and distribution you are actually running, while retaining a tested console or recovery route.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
